Let’s learn to configure automatic lock screen for inactive device Using Intune. You can protect your device from an unauthorized use by lock a computer when idle for some time. The device lock feature allows you to screen lock out option after a period of inactivity.
When you lock the computer, you will be taken to the lock screen by default to unlock and sign in when ready to continue where you left off. However the other users can still sign in to their accounts from the sign-in screen.
If the Machine inactivity limit security policy setting is configured, the device locks not only when inactive time exceeds the inactivity limit, but also when the screensaver activates or when the display turns off because of power settings.
The device lock feature provides protection for lost or stolen devices and provides a means for legitimate users who accidentally enter the device lock state to recover their device and continue using it.
Interactive logon messages may also helpful to reinforce corporate policy by notifying employees of the appropriate policy during the logon process. You can configure this setting in a manner consistent with the security and operational requirements of your organization.
- Enable Interactive Logon CTRL ALT DEL Using Intune
- Collect Intune Logs from MEM Portal Diagnostic Data
- Intune Logs Event IDs IME Logs Details For Windows Client Side Troubleshooting
Set Automatic Lock Screen for Inactive Device Using Intune
Let’s follow the step below to manage device lock inactivity using Intune –
- Sign in to the Endpoint Manager Intune portal https://endpoint.microsoft.com/
- Select Devices > Windows > Configuration profiles > Create profile.
In Create Profile, Select Platform, Windows 10, and later and Profile, Select Profile Type as Settings catalog. Click on Create button.
On the Basics tab, enter a descriptive name, such as Automatic Lock Screen for Inactive Device or Automic Lock for Inactive Windows Device. Optionally, enter a Description for the policy, then select Next.
In Configuration settings, click Add settings to browse or search the catalog for the settings you want to configure.
On the Settings Picker windows, Select Device Lock to see all the settings in this category. Select the below settings, Max Inactivity Time Device Lock.
After adding your settings, click the cross mark at the right-hand corner to close the settings picker.
Note – In policy, use the search box to find specific settings. You can search by category or a keyword, such as
Max Inactivity Time Device Lock/Inactivity Time It will display all the related settings available.
The setting is shown and configured with a default value Disabled. Set Device Password Enabled to Enabled and configure Max Inactivity Time Device Lock with value . And Click Next.
Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. Users can select any existing timeout value less than the specified maximum time in the Settings app.
Under Assignments, In Included groups, click Add groups and then choose Select groups to include one or more groups. Click Next to continue.
In Scope tags, you can assign a tag to filter the profile to specific IT groups. Add scope tags (if required) and click Next.
In Review + create, review your settings. When you select Create, your changes are saved, and the profile is assigned.
A notification will appear automatically in the top right-hand corner with a message. Here you can see that Policy “Automatic Lock for Inactive Windows Device” created successfully. The policy is also shown in the Configuration profiles list.
Your groups will receive your profile settings when the devices check-in with the Intune service. Once the policy applies to the devices, you may required to log out and back in before the policy takes effect.
Reporting – Configure Automatic Lock for Inactive Windows Device
You can check Intune settings catalog profile report from Intune Portal, which provides an overall view of device configuration policies deployment status.
To monitor the policy assignment, from the list of Configuration Profiles, select the policy, and here you can check the device and user check-in status. If you click View Report, additional details are displayed.
Intune MDM Event Log
The Intune event ID indicates a string policy is applied on the Windows 10 or 11 devices. You can also see the exact value of the policy being applied on those devices.
In the target device, You can check the Event log path to confirm – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
you can look at the Event ID 813 generated for the configured policies for managing apps, Here are the highlights from the Event logs.
MDM PolicyManager: Set policy int, Policy: (MaxInactivityTimeDeviceLock), Area: (DeviceLock), EnrollmentID requesting merge: (78BF73E9-4EBB-4575-9EF5-21B30DB3FD4E), Current User: (Device), Int: (0xF), Enrollment Type: (0x6), Scope: (0x0).
Here you can validate whether the registry values are changed or not. You can see the registry entries related to the Device Lock Inactivity Time in the following registry path –
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceLock MaxInactivityTImeDeviceLock (Data should be visible as the value you defined in the policy)
About Author – Jitesh, Microsoft MVP, has over five years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus is Windows 10 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.
9 thoughts on “Easily Configure Automatic Lock Screen for Inactive Device Using Intune”
I’ve been trying this by settings 60 minutes, the value is correctly reflected in the registry, but the client keeps locking after 15 minutes. No conflicts about the same profile. What else could override this setting?
Some quick thoughts – Group Policy if Hybrid Joined device? Power Policies?
For Info, It seems like the setting under “Endpoint protection” , “Local device security options” and “Minutes of lock screen inactivity until screen saver activates” can override the setting displayed in your article.
FYI if you assign this to a device group you may see an extra reboot during Autopilot (between Device and User ESP) which requires the user to sign in again.
Was tearing my hair out until I found this – moving to user assignment, or using a different policy (screensaver) should resolve this.
Do machnes have to be windows ent and not pro to allow configuration policys? I’ve a machine that it works with which is windows 10 ent but dosen’t work for any of our win 10 pro machines.
This feature is available for Pro and Ent. Not for HOME versio https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit
I have followed this plan to the letter but the screen does not lock on the test endpoint. Any suggestions to find what the blocker is…. freshly formatted Windows Surface Laptop 4 with Windows 11 Pro. I see the settings I created on the endpoint but the screen is not locking as I expected.
It seems Max Inactivity Time Device Lock With External Display has been Deprecated. What would be the new setting?
Wondering the same. Is there a new setting for this?